thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

VLAN Hopping

An attack that sends traffic from one VLAN to another without passing through a router, via switch spoofing or double tagging.

Definition

In switch spoofing, the attacker negotiates a trunk using DTP; in double tagging, an outer tag matching the native VLAN is stripped by the first switch, leaving an inner tag for the target VLAN. Disabling DTP, setting access ports explicitly and using an unused native VLAN mitigate it.

Example

Sending 802.1Q frames with two tags from an access port in the native VLAN.

Exam tip

Mitigation: switchport mode access, switchport nonegotiate, and change the native VLAN to an unused ID.

Related terms